CSRF in Go-Vikunja Vikunja
CVE-2026-123494
Vikunja before 2.7.1 contains a cross-site request forgery vulnerability that allows attackers to import their data into a victim's account because the Todoist, Microsoft To Do, and Trello migration OAuth callbacks lack a bound state parameter. Attackers can authorize their own account, keep the unused callback code or token, and lure a logged-in victim to the migration callback route to auto-import attacker-chosen projects and tasks containing phishing links.
Vulnerability class: CSRF (Cross-Site Request Forgery)
Published · last modified .
CVSS v3 metric
CVSS v3 base score 3.5 (Low). Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N.
EPSS exploit prediction
No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.
Affected products
Weakness classification (CWE)
References
- github.com/go-vikunja/vikunja/security/advisories/GHSA-xgw3-ccqg-f6ww (vendor-advisory)
- www.vulncheck.com/advisories/vikunja-before-2.7.1-login-csrf-via-migration-oaut… (third-party-advisory)
Frequently asked questions
- What is CVE-2026-123494?
- CVE-2026-123494 is a low-severity vulnerability in Go-Vikunja Vikunja, classified under Cross-Site Request Forgery (CSRF). CVSS score: 3.5/10. Published 2026-11-08.
- How severe is CVE-2026-123494?
- Low severity. CVSS v3 base score is 3.5 out of 10.